Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
A workspace runner can build any repository in the workspace. A repository runner serves one. Labels, the one-time token and queue rules explained.
Pipes run as Docker containers inside your step. Pin a full version, read the public source, and note that 0.x pipes can break on small version bumps.
Bitbucket has three variable scopes and a fixed override order. Who can manage each, what secured really does, and which scope to use for production keys.
Use the OIDC token a step can create, a web identity provider in AWS and a trust policy on the sub claim. Steps, patterns and a default that is too wide.
Yes, caches are shared across branches and pipelines in a repository, expire after 7 days idle, and have no protected branch split. How to limit the risk.
Artifacts last up to 14 days and 1 GB each. Shared artifacts pass between steps, scoped ones do not. How to limit what lands in them and move records out.
Yes, with a merge check on successful builds, but blocking is a Premium feature. Without it you only get a warning. Setup steps, fork behavior and gaps.
Bitbucket deployments add environment variables, manual promotion and, on Premium, branch restrictions and permissions. What each controls and the gaps.
Bazel records module resolution in MODULE.bazel.lock, but that file is not a package list. See what it holds and how to build an inventory you can scan.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
